symfony/html-sanitizer (Packagist)
Advisories
15
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 8.0.13 or later clears every advisory below that has a fix.
Upgrade commands
composer
composer require symfony/html-sanitizer:^8.0.13Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-v3wm-qf9p-c549 Symfony: HtmlSanitizer URL Parser Deny Gates Underinclusive: Percent-Encoded BiDi Marks and Unicode Whitespace Bypass Visual-Spoofing Defense |
Medium EPSS 0.34% |
>= 6.1.0, < 6.4.41 | 6.4.41 |
| GHSA-v3wm-qf9p-c549 Symfony: HtmlSanitizer URL Parser Deny Gates Underinclusive: Percent-Encoded BiDi Marks and Unicode Whitespace Bypass Visual-Spoofing Defense |
Medium EPSS 0.34% |
>= 8.0.0, < 8.0.13 | 8.0.13 |
| GHSA-v3wm-qf9p-c549 Symfony: HtmlSanitizer URL Parser Deny Gates Underinclusive: Percent-Encoded BiDi Marks and Unicode Whitespace Bypass Visual-Spoofing Defense |
Medium EPSS 0.34% |
>= 7.0.0, < 7.4.13 | 7.4.13 |
| GHSA-x5qj-865h-mgvm Symfony: HtmlSanitizer UrlAttributeSanitizer Misses URL Attributes |
Medium EPSS 0.34% |
>= 7.0.0, < 7.4.13 | 7.4.13 |
| GHSA-x5qj-865h-mgvm Symfony: HtmlSanitizer UrlAttributeSanitizer Misses URL Attributes |
Medium EPSS 0.34% |
>= 8.0.0, < 8.0.13 | 8.0.13 |
| GHSA-x5qj-865h-mgvm Symfony: HtmlSanitizer UrlAttributeSanitizer Misses URL Attributes |
Medium EPSS 0.34% |
>= 6.1.0, < 6.4.41 | 6.4.41 |
| GHSA-hhg7-c65m-h7ff Symfony's HtmlSanitizer UrlAttributeSanitizer Omits action/formaction/poster/cite — `javascript`: URI Survives Sanitization (XSS) |
Medium EPSS 0.34% |
>= 6.1.0, < 6.4.40 | 6.4.40 |
| GHSA-hhg7-c65m-h7ff Symfony's HtmlSanitizer UrlAttributeSanitizer Omits action/formaction/poster/cite — `javascript`: URI Survives Sanitization (XSS) |
Medium EPSS 0.34% |
>= 8.0.0, < 8.0.12 | 8.0.12 |
| GHSA-hhg7-c65m-h7ff Symfony's HtmlSanitizer UrlAttributeSanitizer Omits action/formaction/poster/cite — `javascript`: URI Survives Sanitization (XSS) |
Medium EPSS 0.34% |
>= 7.0.0, < 7.4.12 | 7.4.12 |
| GHSA-qc95-4862-92fh Symfony has an HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URL-Parser Differentials and <area> Misclassification |
Low EPSS 0.34% |
>= 7.0.0, < 7.4.12 | 7.4.12 |
| GHSA-qc95-4862-92fh Symfony has an HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URL-Parser Differentials and <area> Misclassification |
Low EPSS 0.34% |
>= 6.1.0, < 6.4.40 | 6.4.40 |
| GHSA-qc95-4862-92fh Symfony has an HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URL-Parser Differentials and <area> Misclassification |
Low EPSS 0.34% |
>= 8.0.0, < 8.0.12 | 8.0.12 |
| GHSA-h5vq-qfcg-4m6p Symfony's HtmlSanitizer URL Attributes Pass Through BiDi Override Characters → Visual href Spoofing |
Medium EPSS 0.34% |
>= 6.1.0, < 6.4.40 | 6.4.40 |
| GHSA-h5vq-qfcg-4m6p Symfony's HtmlSanitizer URL Attributes Pass Through BiDi Override Characters → Visual href Spoofing |
Medium EPSS 0.34% |
>= 8.0.0, < 8.0.12 | 8.0.12 |
| GHSA-h5vq-qfcg-4m6p Symfony's HtmlSanitizer URL Attributes Pass Through BiDi Override Characters → Visual href Spoofing |
Medium EPSS 0.34% |
>= 7.0.0, < 7.4.12 | 7.4.12 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor